That complicates things. I would check whether subtitles are enabled (burn-in is notoriously slow) and then try manually adding your server via the app (to rule out wan/relay). Could also recreate the issue and check the server logs - timestamps should tell you what actions were taken when.

Difficult to say without more detail but it’s likely transcoding. You can view how much is cached via tautulli if that’s something you have set up.

About a decade ago I worked for T-Mobile on a very similar product. I would be surprised if they used any security considering during my time there, they would commonly ship hackathon projects as-is.